Wrap SPA auth endpoints with 'web' middleware so session cookies persist

[RichPC]

Problem

• SPA auth endpoints were registered under API routes without the 'web' middleware. Session middleware was not applied, so login didn't persist authentication.

Fix

• Wrap SPA auth endpoints (login, register, social callbacks, password, verification) in Route::middleware('web')->group(...).

Verification

• Reproduced login flow locally; session and auth persisted and /api/v1/user returns authenticated user.